From c7ae3fdc9af6e78ddee63fff4a9938df27d0d39d Mon Sep 17 00:00:00 2001 From: Mario Date: Sun, 25 Nov 2018 10:18:26 +0100 Subject: update jquery-file-upload and psr-log via composer --- vendor/blueimp/jquery-file-upload/README.md | 2 +- vendor/blueimp/jquery-file-upload/SECURITY.md | 2 +- vendor/blueimp/jquery-file-upload/angularjs.html | 8 ++--- vendor/blueimp/jquery-file-upload/basic-plus.html | 8 ++--- vendor/blueimp/jquery-file-upload/basic.html | 6 ++-- .../jquery-file-upload/bower-version-update.js | 0 vendor/blueimp/jquery-file-upload/bower.json | 2 +- .../jquery-file-upload/cors/postmessage.html | 2 +- vendor/blueimp/jquery-file-upload/index.html | 6 ++-- vendor/blueimp/jquery-file-upload/jquery-ui.html | 6 ++-- vendor/blueimp/jquery-file-upload/package.json | 2 +- .../server/php/UploadHandler.php | 34 +++++++++++++--------- .../jquery-file-upload/server/php/index.php | 2 +- vendor/blueimp/jquery-file-upload/test/index.html | 6 ++-- 14 files changed, 47 insertions(+), 39 deletions(-) mode change 100755 => 100644 vendor/blueimp/jquery-file-upload/bower-version-update.js mode change 100755 => 100644 vendor/blueimp/jquery-file-upload/server/php/UploadHandler.php (limited to 'vendor/blueimp') diff --git a/vendor/blueimp/jquery-file-upload/README.md b/vendor/blueimp/jquery-file-upload/README.md index d2f104d5c..d9e16ed18 100644 --- a/vendor/blueimp/jquery-file-upload/README.md +++ b/vendor/blueimp/jquery-file-upload/README.md @@ -10,7 +10,7 @@ Supports cross-domain, chunked and resumable file uploads and client-side image ## ⚠️ Security Notice Security related releases: -* [v9.25.1](https://github.com/blueimp/jQuery-File-Upload/releases/tag/v9.25.1) Mitigates some [Potential vulnerabilities with PHP+ImageMagick](VULNERABILITIES.md#potential-vulnerabilities-with-php+imagemagick). +* [v9.25.1](https://github.com/blueimp/jQuery-File-Upload/releases/tag/v9.25.1) Mitigates some [Potential vulnerabilities with PHP+ImageMagick](VULNERABILITIES.md#potential-vulnerabilities-with-php-imagemagick). * [v9.24.1](https://github.com/blueimp/jQuery-File-Upload/releases/tag/v9.24.1) Fixes a [Remote code execution vulnerability in the PHP component](VULNERABILITIES.md#remote-code-execution-vulnerability-in-the-php-component). * v[9.10.1](https://github.com/blueimp/jQuery-File-Upload/releases/tag/9.10.1) Fixes an [Open redirect vulnerability in the GAE components](VULNERABILITIES.md#open-redirect-vulnerability-in-the-gae-components). * Commit [4175032](https://github.com/blueimp/jQuery-File-Upload/commit/41750323a464e848856dc4c5c940663498beb74a) (*fixed in all tagged releases*) Fixes a [Cross-site scripting vulnerability in the Iframe Transport](VULNERABILITIES.md#cross-site-scripting-vulnerability-in-the-iframe-transport). diff --git a/vendor/blueimp/jquery-file-upload/SECURITY.md b/vendor/blueimp/jquery-file-upload/SECURITY.md index db58f7dd7..86ffc163b 100644 --- a/vendor/blueimp/jquery-file-upload/SECURITY.md +++ b/vendor/blueimp/jquery-file-upload/SECURITY.md @@ -113,7 +113,7 @@ location ^~ /path/to/project/server/php/files { ``` ## Secure image processing configurations -The following configuration mitigates [potential image processing vulnerabilities with ImageMagick](VULNERABILITIES.md#potential-vulnerabilities-with-php+imagemagick) by limiting the attack vectors to a small subset of image types (`GIF/JPEG/PNG`). +The following configuration mitigates [potential image processing vulnerabilities with ImageMagick](VULNERABILITIES.md#potential-vulnerabilities-with-php-imagemagick) by limiting the attack vectors to a small subset of image types (`GIF/JPEG/PNG`). Please also consider using alternative, safer image processing libraries like [libvips](https://github.com/libvips/libvips) or [imageflow](https://github.com/imazen/imageflow). diff --git a/vendor/blueimp/jquery-file-upload/angularjs.html b/vendor/blueimp/jquery-file-upload/angularjs.html index 2051bbf79..e8b05e77f 100644 --- a/vendor/blueimp/jquery-file-upload/angularjs.html +++ b/vendor/blueimp/jquery-file-upload/angularjs.html @@ -22,7 +22,7 @@ - + @@ -177,8 +177,8 @@
    - - + + @@ -186,7 +186,7 @@ - + diff --git a/vendor/blueimp/jquery-file-upload/basic-plus.html b/vendor/blueimp/jquery-file-upload/basic-plus.html index acee24843..6d53acdc1 100644 --- a/vendor/blueimp/jquery-file-upload/basic-plus.html +++ b/vendor/blueimp/jquery-file-upload/basic-plus.html @@ -20,7 +20,7 @@ - + @@ -96,15 +96,15 @@ - + - + - + diff --git a/vendor/blueimp/jquery-file-upload/basic.html b/vendor/blueimp/jquery-file-upload/basic.html index 232a24624..a9ef6273e 100644 --- a/vendor/blueimp/jquery-file-upload/basic.html +++ b/vendor/blueimp/jquery-file-upload/basic.html @@ -20,7 +20,7 @@ - + @@ -96,7 +96,7 @@ - + @@ -104,7 +104,7 @@ - + + - + @@ -226,7 +226,7 @@ - + diff --git a/vendor/blueimp/jquery-file-upload/jquery-ui.html b/vendor/blueimp/jquery-file-upload/jquery-ui.html index 842dd4ca7..e44d41e89 100644 --- a/vendor/blueimp/jquery-file-upload/jquery-ui.html +++ b/vendor/blueimp/jquery-file-upload/jquery-ui.html @@ -22,7 +22,7 @@ - + @@ -201,8 +201,8 @@ {% } %} - - + + diff --git a/vendor/blueimp/jquery-file-upload/package.json b/vendor/blueimp/jquery-file-upload/package.json index 4b33a0362..0a635397c 100644 --- a/vendor/blueimp/jquery-file-upload/package.json +++ b/vendor/blueimp/jquery-file-upload/package.json @@ -1,6 +1,6 @@ { "name": "blueimp-file-upload", - "version": "9.25.1", + "version": "9.28.0", "title": "jQuery File Upload", "description": "File Upload widget with multiple file selection, drag&drop support, progress bar, validation and preview images, audio and video for jQuery. Supports cross-domain, chunked and resumable file uploads. Works with any server-side platform (Google App Engine, PHP, Python, Ruby on Rails, Java, etc.) that supports standard HTML form file uploads.", "keywords": [ diff --git a/vendor/blueimp/jquery-file-upload/server/php/UploadHandler.php b/vendor/blueimp/jquery-file-upload/server/php/UploadHandler.php old mode 100755 new mode 100644 index e44004395..5215e4c0f --- a/vendor/blueimp/jquery-file-upload/server/php/UploadHandler.php +++ b/vendor/blueimp/jquery-file-upload/server/php/UploadHandler.php @@ -38,9 +38,9 @@ class UploadHandler 'image_resize' => 'Failed to resize image' ); - protected const IMAGETYPE_GIF = 1; - protected const IMAGETYPE_JPEG = 2; - protected const IMAGETYPE_PNG = 3; + const IMAGETYPE_GIF = 1; + const IMAGETYPE_JPEG = 2; + const IMAGETYPE_PNG = 3; protected $image_objects = array(); @@ -1047,13 +1047,18 @@ class UploadHandler } protected function create_scaled_image($file_name, $version, $options) { - if ($this->options['image_library'] === 2) { - return $this->imagemagick_create_scaled_image($file_name, $version, $options); - } - if ($this->options['image_library'] && extension_loaded('imagick')) { - return $this->imagick_create_scaled_image($file_name, $version, $options); + try { + if ($this->options['image_library'] === 2) { + return $this->imagemagick_create_scaled_image($file_name, $version, $options); + } + if ($this->options['image_library'] && extension_loaded('imagick')) { + return $this->imagick_create_scaled_image($file_name, $version, $options); + } + return $this->gd_create_scaled_image($file_name, $version, $options); + } catch (\Exception $e) { + error_log($e->getMessage()); + return false; } - return $this->gd_create_scaled_image($file_name, $version, $options); } protected function destroy_image_object($file_path) { @@ -1066,12 +1071,12 @@ class UploadHandler $fp = fopen($file_path, 'r'); $data = fread($fp, 4); fclose($fp); - // GIF: 47 49 46 - if (substr($data, 0, 3) === 'GIF') { + // GIF: 47 49 46 38 + if ($data === 'GIF8') { return self::IMAGETYPE_GIF; } - // JPG: FF D8 - if (bin2hex(substr($data, 0, 2)) === 'ffd8') { + // JPG: FF D8 FF + if (bin2hex(substr($data, 0, 3)) === 'ffd8ff') { return self::IMAGETYPE_JPEG; } // PNG: 89 50 4E 47 @@ -1082,6 +1087,9 @@ class UploadHandler } protected function is_valid_image_file($file_path) { + if (!preg_match('/\.(gif|jpe?g|png)$/i', $file_path)) { + return false; + } return !!$this->imagetype($file_path); } diff --git a/vendor/blueimp/jquery-file-upload/server/php/index.php b/vendor/blueimp/jquery-file-upload/server/php/index.php index 9c2cfb8eb..6caabb710 100644 --- a/vendor/blueimp/jquery-file-upload/server/php/index.php +++ b/vendor/blueimp/jquery-file-upload/server/php/index.php @@ -9,7 +9,7 @@ * Licensed under the MIT license: * https://opensource.org/licenses/MIT */ -exit; + error_reporting(E_ALL | E_STRICT); require('UploadHandler.php'); $upload_handler = new UploadHandler(); diff --git a/vendor/blueimp/jquery-file-upload/test/index.html b/vendor/blueimp/jquery-file-upload/test/index.html index 0b5cf57b7..b8c585df5 100644 --- a/vendor/blueimp/jquery-file-upload/test/index.html +++ b/vendor/blueimp/jquery-file-upload/test/index.html @@ -20,7 +20,7 @@ jQuery File Upload Plugin Test - +

    jQuery File Upload Plugin Test

    @@ -145,7 +145,7 @@ {% } %} - + @@ -166,7 +166,7 @@ window.testBasicWidget = $.blueimp.fileupload; /* global window, $ */ window.testUIWidget = $.blueimp.fileupload; - + -- cgit v1.2.3